BinaryFormatter not supported in .net 5 app when loading Bitmap resource

Question

I have migrated a couple of ASP.Net Core 2.2 projects to.Net 5, the last issue I have is that I get a System.NotSupported exception when trying to load bitmaps from the project resources.

RtfUtility.AppendLogo(result, Properties.Resources.Logo);

System.NotSupportedException HResult=0x80131515 Message=BinaryFormatter serialization and deserialization are disabled within this application. See https://aka.ms/binaryformatter for more information. Source=System.Runtime.Serialization.Formatters

I'm not using BinaryFormatter explicitly but oddly I don't get an error when loading a binary PDF file in the same way:

processor.LoadDocument(new MemoryStream(Properties.Resources.Certificate));

Both mechanisms use ResourceManager.GetObject , so I'm not sure whats going on. I know I can turn off the error in the project file, but that seems to be a short term solution, I'd rather fix it and forget it. Thanks for any advice you can give...

Edit:

Stack Trace is below, The error is not caused by the library, it is when accessing the resource. It happens when the image is embedded or linked - seems to make no difference, but doesn't happen with a (binary) PDF file.

Thanks for looking at this...

at System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Deserialize(Stream serializationStream) at System.Resources.ResourceReader.<>c__DisplayClass7_0`1.b__0(Object obj, Stream stream) at System.Resources.ResourceReader.DeserializeObject(Int32 typeIndex) at System.Resources.ResourceReader._LoadObjectV2(Int32 pos, ResourceTypeCode& typeCode) at System.Resources.ResourceReader.LoadObjectV2(Int32 pos, ResourceTypeCode& typeCode) at System.Resources.ResourceReader.LoadObject(Int32 pos, ResourceTypeCode& typeCode) at System.Resources.RuntimeResourceSet.GetObject(String key, Boolean ignoreCase, Boolean isString) at System.Resources.RuntimeResourceSet.GetObject(String key, Boolean ignoreCase) at System.Resources.ResourceManager.GetObject(String name, CultureInfo culture, Boolean wrapUnmanagedMemStream) at System.Resources.ResourceManager.GetObject( String name, CultureInfo culture) at Project.Infrastructure.Properties.Resources.get_Logo() in C:\Development\Project\Project.Infrastructure\Properties\Resources.Designer.cs:line 227 at Project.Infrastructure.Models.ShowWording.Generate() in C:\Development\Project\Project.Infrastructure\Models\ShowWording.cs:line 146

Answer 1

There is an option to re enable binaryformatter in .Net 5 asp.Net apps by adding the following to the project file.

<PropertyGroup>
  <TargetFramework>net5.0</TargetFramework>
  <!-- Warning: Setting the following switch is *NOT* recommended in web apps. -->
  <EnableUnsafeBinaryFormatterSerialization>true</EnableUnsafeBinaryFormatterSerialization>
</PropertyGroup>

From BinaryFormatter serialization methods are obsolete and prohibited in ASP.NET apps . Note the warnings about doing this, since binaryformatter is inherently insecure.

If this is used indirectly by a library you might consider contacting the library vendor for an updated version, or switch to another library.

Answer 2

I found a workaround, that doesn't make sense, but I trust it more than allowing unsafe Binary Formatters in my projects.

Following on from your suggestions I tried deleting and recreating the resource file, removing and re-adding the affected image, but nothing worked.

So, because reading a pdf file worked, I removed the .png extension from my image and saved it as a File resource.

I can now read it from resources as binary and convert it to Bitmap and it works fine.

using (var ms = new MemoryStream(Properties.Resources.LogoBinary))
{
   return  new Bitmap(ms);
}

I can't believe this is a bug in the framework, as it would affect a lot of people, it must be something peculiar to my project, but it is odd that I get the BinaryFormatter exception when reading an image, but not a Binary file...

Thanks everyone for your guidance & assistance...

Answer 3

It seems that Visual Studio/.Net previously made images added as resources accessible as Image , which makes use of the BinaryFormatter , while if I now add images they are accessible as byte[] .

I was able to update the resource file to only return byte[] by simply:

1. Replacing System.Drawing.Bitmap with byte[] in the *.Designer.cs file
2. Replacing System.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a with System.Byte[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 in the *.resx file

Previously:

// In the *.Designer.cs file
public static System.Drawing.Bitmap MyImage {
  get {
    object obj = ResourceManager.GetObject("MyImage", resourceCulture);
    return ((System.Drawing.Bitmap)(obj));
  }
}

// In the *.resx file
<data name="MyImage" type="System.Resources.ResXFileRef, System.Windows.Forms">
    <value>Path\To\MyImage.jpg;System.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a</value>
  </data>

Now:

// In the *.Designer.cs file
public static byte[] MyImage {
  get {
    object obj = ResourceManager.GetObject("MyImage", resourceCulture);
    return ((byte[])(obj));
  }
}

// In the *.resx file
<data name="MyImage" type="System.Resources.ResXFileRef, System.Windows.Forms">
    <value>Path\To\MyImage.jpg;System.Byte[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value></value>
  </data>